Overengineering a mirror - Part 1: PXE-booting a k3s cluster

source "qemu" "amd64_uefi" {
  iso_url           = var.iso_url
  iso_checksum      = var.iso_checksum
  output_directory  = "output/qemu_amd64_uefi"
  
  shutdown_command = "poweroff"
  disk_size         = "5G"
  memory            = "4096"
  cpus              = 4
  machine_type    = "q35"
  format            = "raw"
  accelerator       = "kvm"

  vm_name = "debian"
  efi_boot         = true
  efi_firmware_code = "/usr/share/edk2/x64/OVMF_CODE.4m.fd"
  efi_firmware_vars = "/usr/share/edk2/x64/OVMF_VARS.4m.fd"
  //headless = true

  ssh_username      = "root"
  ssh_password      = "packer"
  ssh_timeout       = "20m"

  // see: https://developer.hashicorp.com/packer/guides/automatic-operating-system-installs/preseed_ubuntu
  http_directory = "http"
  http_port_min  = 8100
  http_port_max  = 8100

  boot_wait         = "5s"
  boot_command = [
    "<wait>c<wait>",
    "linux /install.amd/vmlinuz ",
    "auto=true ",
    "url=http://{{ .HTTPIP }}:{{ .HTTPPort }}/qemu_uefi_preseed.cfg ",
    "hostname=${var.template_name} ",
    "domain=lan ",
    "interface=auto ",
    "vga=788 noprompt quiet --<enter>",
    "initrd /install.amd/initrd.gz<enter>",
    "boot<enter>"
  ]
}

build {
  name = "debian_image"

  sources = ["source.qemu.amd64_uefi"]

  # Run our install script
  provisioner "shell" {
    script = "./scripts/install.sh"
    environment_vars = [
      "K3S_VERSION=${var.k3s_version}",
      "K3S_TOKEN=${var.k3s_token}",
      "K3S_URL=${var.k3s_url}",
      "INSTALL_K3S=true",
      "INSTALL_ISCSI=true",
      "INSTALL_DYNHOSTNAME=true"
    ]
  }

  provisioner "file" {
    content = join("\n", var.authorized_keys)
    destination = "/root/.ssh/authorized_keys"
  }

  provisioner "shell" {
    # make login public key only
    inline = [
      "chmod 600 /root/.ssh/authorized_keys",
      "sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config",
      "sed -i 's/^PermitRootLogin yes/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config",
    ]
  }
}

boot_command = [
    "<wait>c<wait>",
    "linux /install.amd/vmlinuz ",
    "auto=true ",
    "url=http://{{ .HTTPIP }}:{{ .HTTPPort }}/qemu_uefi_preseed.cfg ",
    "hostname=${var.template_name} ",
    "domain=lan ",
    "interface=auto ",
    "vga=788 noprompt quiet --<enter>",
    "initrd /install.amd/initrd.gz<enter>",
    "boot<enter>"
]

# Inspired from: https://www.debian.org/releases/stable/example-preseed.txt (trixie)

#_preseed_V1
#### Contents of the preconfiguration file (for trixie)
### Localization
# Preseeding only locale sets language, country and locale.
d-i debian-installer/locale string en_US.UTF-8

# Keyboard selection.
d-i keyboard-configuration/xkb-keymap select fr

### Network configuration

# netcfg will choose an interface that has link if possible. This makes it
# skip displaying a list if there is more than one interface.
d-i netcfg/choose_interface select auto

# To pick a particular interface instead:
#d-i netcfg/choose_interface select ens18

# Any hostname and domain names assigned from dhcp take precedence over
# values set here. However, setting the values still prevents the questions
# from being shown, even if values come from dhcp.
d-i netcfg/get_hostname string unassigned-hostname
d-i netcfg/get_domain string unassigned-domain

# Disable that annoying WEP key dialog.
d-i netcfg/wireless_wep string
# The wacky dhcp hostname that some ISPs use as a password of sorts.
#d-i netcfg/dhcp_hostname string radish

### Mirror settings
# Mirror protocol:
# If you select ftp, the mirror/country string does not need to be set.
# Default value for the mirror protocol: http.
#d-i mirror/protocol string ftp
d-i mirror/country string France
d-i mirror/http/hostname string ftp.fr.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string

# Skip creation of a normal user account.
d-i passwd/make-user boolean false

# Root password
d-i passwd/root-password password packer
d-i passwd/root-password-again password packer

### Clock and time zone setup

# Controls whether or not the hardware clock is set to UTC.
d-i clock-setup/utc boolean true

# You may set this to any valid setting for $TZ; see the contents of
# /usr/share/zoneinfo/ for valid values.
d-i time/zone string EU/Paris

# Controls whether to use NTP to set the clock during the install
d-i clock-setup/ntp boolean true

### Partitioning
## Partitioning example
# If the system has free space you can choose to only partition that space.
# This is only honoured if partman-auto/method (below) is not set.
#d-i partman-auto/init_automatically_partition select biggest_free

# Alternatively, you may specify a disk to partition. If the system has only
# one disk the installer will default to using that, but otherwise the device
# name must be given in traditional, non-devfs format (so e.g. /dev/sda
# and not e.g. /dev/discs/disc0/disc).
# For example, to use the first SCSI/SATA hard disk:
#d-i partman-auto/disk string /dev/sda
# In addition, you'll need to specify the method to use.
# The presently available methods are:
# - regular: use the usual partition types for your architecture
# - lvm:     use LVM to partition the disk
# - crypto:  use LVM within an encrypted partition
d-i partman-auto/method string regular

# You can choose one of the predefined partitioning recipes:
# - atomic: all files in one partition
# - home:   separate /home partition
# - multi:  separate /home, /var, and /tmp partitions
# - server: separate /var and /srv partitions; swap limitted to 1G
# - small_disk: scheme dedicated to small harddrives (under 10GB)
d-i partman-basicfilesystems/no_swap boolean false
d-i partman-auto/expert_recipe string myroot :: 512 512 512 fat32 \
     $primary{ } $bootable{ } method{ efi } \
     format{ } \
    . \
    1000 50 -1 ext4 \
     $primary{ } method{ format } \
     format{ } use_filesystem{ } filesystem{ ext4 } \
     mountpoint{ / } \
    .
d-i partman-auto/choose_recipe select myroot

# This makes partman automatically partition without confirmation, provided
# that you told it what to do using one of the methods above.
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

### Base system installation
# Configure APT to not install recommended packages by default. Use of this
# option can result in an incomplete system and should only be used by very
# experienced users.
d-i base-installer/install-recommends boolean false

### Apt setup
# Choose, if you want to scan additional installation media
# (default: false).
d-i apt-setup/cdrom/set-first boolean false
# You can choose to install non-free and contrib software.
d-i apt-setup/non-free boolean true
d-i apt-setup/contrib boolean true
# Uncomment the following line, if you don't want to have the sources.list
# entry for a DVD/BD installation image active in the installed system
# (entries for netinst or CD images will be disabled anyway, regardless of
# this setting).
d-i apt-setup/disable-cdrom-entries boolean true

### Package selection
tasksel tasksel/first multiselect standard, ssh-server

popularity-contest popularity-contest/participate boolean false

### Boot loader installation
# Grub is the boot loader (for x86).

# This is fairly safe to set, it makes grub install automatically to the UEFI
# partition/boot record if no other operating system is detected on the machine.
d-i grub-installer/only_debian boolean true

# This one makes grub-installer install to the UEFI partition/boot record, if
# it also finds some other OS, which is less safe as it might not be able to
# boot that other OS.
d-i grub-installer/with_other_os boolean true

# Due notably to potential USB sticks, the location of the primary drive can
# not be determined safely in general, so this needs to be specified:
d-i grub-installer/bootdev  string default
# To install to the primary device (assuming it is not a USB stick):
#d-i grub-installer/bootdev  string default

# Use the following option to add additional boot parameters for the
# installed system (if supported by the bootloader installer).
# Note: options passed to the installer will be added automatically.
#d-i debian-installer/add-kernel-opts string nousb

### Finishing up the installation
# During installations from serial console, the regular virtual consoles
# (VT1-VT6) are normally disabled in /etc/inittab. Uncomment the next
# line to prevent this.
#d-i finish-install/keep-consoles boolean true

# Avoid that last message about the install being complete.
d-i finish-install/reboot_in_progress note

#### Advanced options
### Running custom commands during the installation
# d-i preseeding is inherently not secure. Nothing in the installer checks
# for attempts at buffer overflows or other exploits of the values of a
# preconfiguration file like this one. Only use preconfiguration files from
# trusted locations! To drive that home, and because it's generally useful,
# here's a way to run any shell command you'd like inside the installer,
# automatically.

# This first command is run as early as possible, just after
# preseeding is read.
#d-i preseed/early_command string anna-install some-udeb
# This command is run immediately before the partitioner starts. It may be
# useful to apply dynamic partitioner preseeding that depends on the state
# of the disks (which may not be visible when preseed/early_command runs).
#d-i partman/early_command \
#       string debconf-set partman-auto/disk "$(list-devices disk | head -n1)"
# This command is run just before the install finishes, but when there is
# still a usable /target directory. You can chroot to /target and use it
# directly, or use the apt-install and in-target commands to easily install
# packages and run commands in the target system.
#d-i preseed/late_command string apt-install zsh; in-target chsh -s /bin/zsh

# Enable root login over SSH (for packer)
d-i preseed/late_command string in-target sed -e 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' -i /etc/ssh/sshd_config

d-i partman-basicfilesystems/no_swap boolean false
d-i partman-auto/expert_recipe string myroot :: 512 512 512 fat32 \
     $primary{ } $bootable{ } method{ efi } \
     format{ } \
    . \
    1000 50 -1 ext4 \
     $primary{ } method{ format } \
     format{ } use_filesystem{ } filesystem{ ext4 } \
     mountpoint{ / } \
    .
d-i partman-auto/choose_recipe select myroot

source "cross" "rpi_arm64" {
  file_checksum_type    = "sha256"
  file_checksum_url     = "https://downloads.raspberrypi.org/raspios_lite_arm64/images/raspios_lite_arm64-2025-12-04/2025-12-04-raspios-trixie-arm64-lite.img.xz.sha256"
  file_target_extension = "xz"
  file_unarchive_cmd    = ["xz", "--decompress", "$ARCHIVE_PATH"]
  file_urls             = ["https://downloads.raspberrypi.org/raspios_lite_arm64/images/raspios_lite_arm64-2025-12-04/2025-12-04-raspios-trixie-arm64-lite.img.xz"]
  image_build_method    = "resize"
  image_chroot_env      = ["PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin"]
  // use fdisk -lu disk.img to find partition info
  image_partitions {
    filesystem   = "vfat"
    mountpoint   = "/boot"
    name         = "boot"
    size         = "512M"
    start_sector = "16384"
    type         = "c"
  }
  image_partitions {
    filesystem   = "ext4"
    mountpoint   = "/"
    name         = "root"
    size         = "0"
    start_sector = "1064960"
    type         = "83"
  }
  image_path                   = "output/rpi_arm64.img"
  image_size                   = "6G"
  image_type                   = "dos"
  qemu_binary_destination_path = "/usr/bin/qemu-aarch64-static"
  qemu_binary_source_path      = "/usr/bin/qemu-aarch64-static"
}

build {
  name = "rpi3_image"
  sources = ["source.cross.rpi_arm64"]

  # Run our install script
  provisioner "shell" {
    script = "./scripts/install.sh"
    environment_vars = [
      "K3S_VERSION=${var.k3s_version}",
      "K3S_TOKEN=${var.k3s_token}",
      "K3S_URL=${var.k3s_url}",
      "INSTALL_K3S=true",
      "INSTALL_ISCSI=true",
      "INSTALL_DYNHOSTNAME=true",
      "TARGET_PLATFORM=rpi",
    ]
  }

  provisioner "file" {
    content = join("\n", var.authorized_keys)
    destination = "/root/.ssh/authorized_keys"
  }

  provisioner "shell" {
    # make login public key only
    inline = [
      "chmod 600 /root/.ssh/authorized_keys",
      "sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config",
      "sed -i 's/^PermitRootLogin yes/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config",
    ]
  }
}

image_partitions {
    filesystem   = "vfat"
    mountpoint   = "/boot"
    name         = "boot"
    size         = "512M"
    start_sector = "16384"
    type         = "c"
  }
  image_partitions {
    filesystem   = "ext4"
    mountpoint   = "/"
    name         = "root"
    size         = "0"
    start_sector = "1064960"
    type         = "83"
  }

#!/bin/bash

set -e

# configure locale to en_US.UTF-8
export DEBIAN_FRONTEND=noninteractive
export LC_CTYPE=en_US.UTF-8
export LC_ALL=en_US.UTF-8

# install basic utils
echo "Installing basic utilities"
apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends sudo nano curl wget htop ncdu nfs-common iptables

# install k3s agent
if [ "$INSTALL_K3S" == "true" ]; then
    echo "Installing k3s: $K3S_VERSION"
    wget https://get.k3s.io -O /root/get-k3s.sh
    chmod +x /root/get-k3s.sh

    if [ -z "$K3S_URL" ] || [ -z "$K3S_TOKEN" ]; then
        INSTALL_K3S_SKIP_ENABLE=true INSTALL_K3S_VERSION=$K3S_VERSION /root/get-k3s.sh
    else
        K3S_EXEC="agent"
        if [ "$TARGET_PLATFORM" == "rpi" ]; then
            K3S_EXEC="agent --node-taint droso/target-type=lowpower:NoSchedule"
        fi
        INSTALL_K3S_SKIP_START=true K3S_URL="$K3S_URL" K3S_TOKEN="$K3S_TOKEN" INSTALL_K3S_VERSION=$K3S_VERSION INSTALL_K3S_EXEC="$K3S_EXEC" /root/get-k3s.sh
    fi
    echo "fs.inotify.max_user_watches=2099999999" >> /etc/sysctl.d/10-ionotify.conf
    echo "fs.inotify.max_user_instances=2099999999" >> /etc/sysctl.d/10-ionotify.conf
    echo "fs.inotify.max_queued_events=2099999999" >> /etc/sysctl.d/10-ionotify.conf
fi

if [ "$INSTALL_ISCSI" == "true" ]; then
    # install open-iscsi and rebuild initramfs
    echo "Installing iSCSI initiator"
    apt-get install -y open-iscsi initramfs-tools

    touch /etc/iscsi/iscsi.initramfs

    if [ "$TARGET_PLATFORM" == "rpi" ]; then
        kernel_version=$(dd if=/boot/kernel8.img 2>/dev/null | gunzip | strings | grep "Linux version" | awk '{print $3}' | head -n 1)
        echo "Detected kernel version: $kernel_version"
        echo "CONFIG_RD_ZSTD=y" > /boot/config-$kernel_version
        mkinitramfs -o /boot/initramfs8 $kernel_version
    else
        update-initramfs -u
    fi
fi

if [ "$INSTALL_DYNHOSTNAME" == "true" ]; then
    echo "Installing dynamic hostname service"
    script_data="$(cat <<-EOF
#!/bin/bash
set -e  
# Find the first ethernet network interface
interface=\$(
    for iface_path in /sys/class/net/*; do
        iface=\$(basename "\$iface_path")
        case "\$iface" in
            eth*|en*) ;;
            *) continue ;;
        esac
        echo "\$iface"
        break
    done
)
echo "Using network interface: \$interface"
mac_addr=\$(cat /sys/class/net/\$interface/address 2>/dev/null || echo "00:00:00:00:00:00")
short_mac=\$(echo \$mac_addr | tr -d ':' | cut -c7-12)
new_hostname="k3s-\$short_mac"
echo "Setting new hostname to \$new_hostname"
echo "\$new_hostname" > /etc/hostname
hostname "\$new_hostname"
EOF
)"
    echo "$script_data" > /usr/local/bin/dynhostname
    chmod +x /usr/local/bin/dynhostname

    service_data="$(cat <<-EOF
[Unit]
Description=Set dynamic hostname based on MAC address
Wants=network-pre.target
Before=network-pre.target

[Service]
ExecStart=/usr/local/bin/dynhostname
Type=oneshot

[Install]
WantedBy=multi-user.target
EOF
)"
    echo "$service_data" > /etc/systemd/system/dynhostname.service
    systemctl enable dynhostname.service
fi

if [ "$INSTALL_CLOUD_INIT" == "true" ]; then
    echo "Configuring cloud-init"
    apt-get install -y --no-install-recommends cloud-init cloud-guest-utils cloud-utils
fi

if [ "$TARGET_PLATFORM" == "rpi" ]; then
    echo "Configuring Raspberry Pi specific settings"
    systemctl disable userconfig.service
fi

# configure networking
if [ "$TARGET_PLATFORM" != "rpi" ]; then
    echo "Configuring networking"
    apt-get install -y --no-install-recommends netplan.io systemd-resolved libnss-resolve libnss-myhostname systemd-timesyncd
    apt-get remove -y --purge ifupdown
    rm -rf /etc/network/interfaces.d
    systemctl enable systemd-networkd.service
    systemctl enable systemd-resolved.service
fi

if [ "$INSTALL_CLOUD_INIT" == "true" ]; then
    rm -rf /etc/netplan/* # cloud-init will handle netplan configs, so remove any existing files
fi

echo "Installation complete"

/> ls
o- / ............................................................................................................. [...]
  o- backstores .................................................................................................. [...]
  | o- fileio ..................................................................................... [Storage Objects: 2]
  | | o- lun_rpi3b ..................................... [/srv/iscsi/nvme1/pxe/rpi3b.img (32.0GiB) write-back activated]
  | | | o- alua ....................................................................................... [ALUA Groups: 1]
  | | |   o- default_tg_pt_gp ........................................................... [ALUA state: Active/optimized]
  | | o- lun_srv_dell ................................ [/srv/iscsi/nvme1/pxe/srvdell.img (64.0GiB) write-back activated]
  | |   o- alua ....................................................................................... [ALUA Groups: 1]
  | |     o- default_tg_pt_gp ........................................................... [ALUA state: Active/optimized]
  | o- pscsi ...................................................................................... [Storage Objects: 0]
  | o- ramdisk .................................................................................... [Storage Objects: 0]
  o- iscsi ................................................................................................ [Targets: 2]
  | o- iqn.2023-06.tld.mydomain.myserver:nvme1.pxe ........................................................... [TPGs: 1]
  |   o- tpg1 ................................................................................... [no-gen-acls, no-auth]
  |     o- acls .............................................................................................. [ACLs: 2]
  |     | o- iqn.2023-06.tld.mydomain.pxe:aa-aa-aa-aa-aa-aa ........................................... [Mapped LUNs: 1]
  |     | | o- mapped_lun0 ................................................................ [lun1 fileio/lun_rpi3b (rw)]
  |     | o- iqn.2023-06.tld.mydomain.pxe:bb-bb-bb-bb-bb-bb ........................................... [Mapped LUNs: 1]
  |     |   o- mapped_lun0 ............................................................. [lun0 fileio/lun_srv_dell (rw)]
  |     o- luns .............................................................................................. [LUNs: 2]
  |     | o- lun0 .......................... [fileio/lun_srv_dell (/srv/iscsi/nvme1/pxe/srvdell.img) (default_tg_pt_gp)]
  |     | o- lun1 ............................... [fileio/lun_rpi3b (/srv/iscsi/nvme1/pxe/rpi3b.img) (default_tg_pt_gp)]
  |     o- portals ........................................................................................ [Portals: 1]
  |       o- 0.0.0.0:3260 ......................................................................................... [OK]
  o- loopback ............................................................................................. [Targets: 0]
  o- srpt ................................................................................................. [Targets: 0]
  o- vhost ................................................................................................ [Targets: 0]
  o- xen-pvscsi ........................................................................................... [Targets: 0]
/>

- hosts: kirito
  name: "Setup iSCSI Target for PXE Boot"
  become: true
  gather_facts: true
  vars:
    pxe_config: "{{ lookup('file', '../../../settings/pxe.yaml') | from_yaml }}"
    pxe_base_iscsi_path: "{{ pxe_iscsi_path }}"
    iscsi_targets:
      - name: "{{ pxe_config.iscsi_target.iqn }}"
        disks: >-
          {%- set disks = [] -%}
          {%- for pxe_item in pxe_config.pxe -%}
          {%- set disk = {
              'name': 'lun_' + pxe_item.name,
              'path': pxe_base_iscsi_path + pxe_item.iscsi_target_path,
              'size': pxe_item.image_size_gb|string + 'G',
              'type': 'fileio',
              'lunid': loop.index0
          } -%}
          {%- set _ = disks.append(disk) -%}
          {%- endfor -%}
          {{ disks }}
        initiators: >-
          {%- set initiators = [] -%}
          {%- for pxe_item in pxe_config.pxe -%}
          {%- set initiator = {
              'name': pxe_item.iscsi_initiator_iqn,
              'authentication': {
                'userid': pxe_config.iscsi_target.username,
                'password': pxe_config.iscsi_target.password
              },
              'mapped_luns': [{
                'mapped_lunid': 0,
                'lunid': loop.index0
              }]
          } -%}
          {%- set _ = initiators.append(initiator) -%}
          {%- endfor -%}
          {{ initiators }}
        portals:
          - ip: "0.0.0.0"
            port: 3260

  roles:
    - role: ricsanfre.iscsi_target

# PXE configuration file
# this is a common file used by:
#   - the pxe script to prepare the iSCSI and tftp file trees (and patch the rpi cmdlines)
#   - the ansible playbook to deploy the iSCSI disk images and tftp files
#   - the ansible playbook to setup the iSCSI targets on the server

iscsi_target:
  ip: "storage_server_ip"
  port: 3260
  iqn: iqn.2023-06.tld.domain.storage_server_name:nvme1.pxe
  username: <username>
  password: <password>

#  base_iscsi_target_path: /srv/iscsi/nvme1/pxe/

ipxe:
  iscsi_initiator_iqn: "iqn.2023-06.tld.domain.pxe:${mac:hexhyp}" # the ${mac:hexhyp} variable only works with iPXE
  boot_config:
    k3s:
      initrd_path: initrd.img # path inside the disk image (to extract from)
      kernel_path: vmlinuz
      source_image_path: qemu_amd64_uefi/debian # path on the building machine, relative to the "src_img_path" supplied to the script
      tftp_dir: k3s # subdirectory in the tftp root where to place the boot files

# there are two types of supported boot types:
#  - ipxe: standard iPXE boot, used by x86_64 and similar architectures
#      - requires a ipxe_boot_config option to select the correct ipxe boot config to use (to get the kernel/initrd and ipxe bootloader)
#      - requires the iscsi_initiator_iqn to be set to a fixed value (as ansible can't know the MAC address in advance)
#  - rpi: Raspberry Pi network boot, which uses its own firmware and
#      - requires the iscsi_initiator_iqn to be set to a fixed value (cannot use ${mac:hexhyp})
#      - requires the source_image_path to point to the base disk image to use
#      - requires the serial_number of the rpi (grep Serial /proc/cpuinfo) (used to set the tftp_dir)

pxe:
  - name: srv_dell
    iscsi_target_path: srvdell.img # path of the disk image on the target server (relative to the target pxe mount point)
    boot_type: ipxe
    ipxe_boot_config: k3s
    iscsi_initiator_iqn: "iqn.2023-06.tld.domain.pxe:aa-aa-aa-aa-aa-aa"
    image_size_gb: 32 # default size of the disk image to expand to

  - name: rpi3b
    iscsi_target_path: rpi3b.img
    boot_type: rpi
    iscsi_initiator_iqn: "iqn.2023-06.tld.domain.pxe:bb-bb-bb-bb-bb-bb"
    source_image_path: rpi_arm64.img
    serial_number: xxxxxxxxx
    image_size_gb: 32

#!python3

import shutil
import yaml
import os
import subprocess

MOUNT_POINT = "/mnt/packer_data_tmp"

def mount_image(src_img_path, partition):
    if not os.path.exists(MOUNT_POINT):
        os.makedirs(MOUNT_POINT)
    
    loop_dev = subprocess.run(["losetup", "-f", "--show", "-P", src_img_path], stdout=subprocess.PIPE, check=True)
    loop_dev_path = loop_dev.stdout.decode().strip()
    subprocess.run(["mount", f"{loop_dev_path}p{partition}", MOUNT_POINT], check=True)
    return loop_dev_path

def unmount_image(loop_dev_path):
    subprocess.run(["umount", MOUNT_POINT], check=True)
    subprocess.run(["losetup", "-d", loop_dev_path], check=True)

def expand_image(img_path, size_mb):
    if not os.path.exists(img_path):
        raise FileNotFoundError(f"Image not found: {img_path}")
    if not os.path.isfile(img_path):
        raise ValueError(f"Image is not a file: {img_path}")

    # Create a sparse file of the desired size
    subprocess.run(["dd", "if=/dev/zero", f"of={img_path}", "bs=1M", "count=0", f"seek={size_mb}"], check=True)
    
    loop_dev = subprocess.run(["losetup", "-f", "--show", "-P", img_path], stdout=subprocess.PIPE, check=True)
    loop_dev_path = loop_dev.stdout.decode().strip()

    # Move GPT backup header to end of disk if required
    parted_output = subprocess.run(["parted", loop_dev_path, "--script", "print"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=True)
    is_gpt = "gpt" in parted_output.stdout.decode().lower()
    if is_gpt:
        subprocess.run(["sgdisk", "-e", loop_dev_path], check=True)

    # Resize partition 2 to fill the disk
    subprocess.run(["parted", loop_dev_path, "--script", "resizepart 2 100%"], check=True)

    # Resize filesystem on partition 2
    subprocess.run(["fsck", "-f", f"{loop_dev_path}p2"], check=True)
    subprocess.run(["resize2fs", f"{loop_dev_path}p2"], check=True)
    subprocess.run(["fsck", "-f", f"{loop_dev_path}p2"], check=True)

    subprocess.run(["losetup", "-d", loop_dev_path], check=True)



class PXEDispatcher:
    def __init__(self, config_path, src_img_path, output_path):
        self.script_root = os.getcwd()
        self.src_img_path = src_img_path

        self.tftp_dir = os.path.join(output_path, "tftp")
        self.iscsi_dir = os.path.join(output_path, "iscsi")

        if os.path.exists(output_path):
            shutil.rmtree(output_path)
        os.makedirs(self.tftp_dir)
        os.makedirs(self.iscsi_dir)

        with open(config_path, 'r') as f:
            self.cfg = yaml.safe_load(f)

        self.target_iscsi_args = f"ISCSI_TARGET_NAME={self.cfg['iscsi_target']['iqn']} ISCSI_TARGET_IP={self.cfg['iscsi_target']['ip']} ISCSI_TARGET_PORT={self.cfg['iscsi_target']['port']} ISCSI_AUTHMETHOD=CHAP ISCSI_USER={self.cfg['iscsi_target']['username']} ISCSI_PW={self.cfg['iscsi_target']['password']}"

        subprocess.run(["docker", "build", "-t", "ipxe_builder", "."], cwd=self.script_root, check=True)


    def build_ipxe_efi(self, tftp_dir, dst_path):
        tmp_dir = os.path.join(self.script_root, "tmp_ipxe_build")
        if os.path.exists(tmp_dir):
            shutil.rmtree(tmp_dir)
        os.makedirs(tmp_dir)

        tftp_dir = tftp_dir.strip("/")
        if tftp_dir != "":
            tftp_dir += "/"

        with open(os.path.join(tmp_dir, "boot.ipxe"), 'w') as f:
            f.write("#!ipxe\n")
            f.write("dhcp\n")
            f.write(f"kernel {tftp_dir}vmlinuz root=/dev/sda2 ro quiet ip=dhcp ISCSI_INITIATOR={self.cfg['ipxe']['iscsi_initiator_iqn']} {self.target_iscsi_args}\n")
            f.write(f"initrd {tftp_dir}initrd.img\n")
            f.write("boot\n")

        build_cmd = [
            "docker", "run", "-it", "--rm",
            "-v", f"{tmp_dir}:/data",
            "ipxe_builder"
        ]
        subprocess.run(build_cmd, check=True)

        shutil.move(os.path.join(tmp_dir, "ipxe.efi"), dst_path)
        shutil.rmtree(tmp_dir)



    def process_ipxe_config(self, boot_config, matching_pxe_entries):
        tftp_dir = os.path.join(self.tftp_dir, boot_config["tftp_dir"])
        os.makedirs(tftp_dir, exist_ok=True)

        src_img = os.path.join(self.src_img_path, boot_config["source_image_path"])
        if not os.path.exists(src_img):
            raise FileNotFoundError(f"Source image not found: {src_img}")

        # extract boot file from source image
        loopdev = mount_image(src_img, "2")
        shutil.copy(os.path.join(MOUNT_POINT, boot_config["initrd_path"]), os.path.join(tftp_dir, "initrd.img"))
        shutil.copy(os.path.join(MOUNT_POINT, boot_config["kernel_path"]), os.path.join(tftp_dir, "vmlinuz"))
        unmount_image(loopdev)

        # copy ipxe bootloader
        self.build_ipxe_efi(boot_config["tftp_dir"], os.path.join(tftp_dir, "ipxe.efi"))

        # add disk image for each initiator
        for pxe in matching_pxe_entries:
            dst = os.path.join(self.iscsi_dir, pxe["iscsi_target_path"])
            shutil.copy(src_img, dst)
            expand_image(dst, pxe["image_size_gb"] * 1024)


    def process_rpi_entry(self, pxe_entry):
        tftp_dir = os.path.join(self.tftp_dir, pxe_entry["serial_number"])
        os.makedirs(tftp_dir, exist_ok=True)

        src_img = os.path.join(self.src_img_path, pxe_entry["source_image_path"])
        if not os.path.exists(src_img):
            raise FileNotFoundError(f"Source image not found: {src_img}")

        # extract boot files from source image
        loopdev = mount_image(src_img, "1")
        subprocess.run(["rsync", "-avhP", f"{MOUNT_POINT}/", tftp_dir], check=True)
        unmount_image(loopdev)

        # copy bootcode.bin if missing
        bootcode_dst = os.path.join(self.tftp_dir, "bootcode.bin")
        if not os.path.exists(bootcode_dst):
            shutil.copy(os.path.join(tftp_dir, "bootcode.bin"), bootcode_dst)

        # patch cmdline.txt and config.txt
        # cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory are required for k3s
        cmdline = "console=serial0,115200 console=tty1 ip=dhcp root=/dev/sda2 rootfstype=ext4 elevator=deadline cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory rootwait rw "
        iscsi_params = f"ISCSI_INITIATOR={pxe_entry['iscsi_initiator_iqn']} {self.target_iscsi_args}"

        cmdline_path = os.path.join(tftp_dir, "cmdline.txt")
        with open(cmdline_path, 'w+') as f:
            f.write(cmdline + iscsi_params + "\n")

        # The 2712 suffix is for Raspberry Pi 5, while v8 is for all previous generations
        config_path = os.path.join(tftp_dir, "config.txt")
        with open(config_path, 'a') as f:
            f.write("\n")
            f.write("kernel=kernel8.img\n")
            f.write("initramfs initramfs8 followkernel\n")

        # add disk image for each initiator
        dst = os.path.join(self.iscsi_dir, pxe_entry["iscsi_target_path"])
        shutil.copy(src_img, dst)
        expand_image(dst, pxe_entry["image_size_gb"] * 1024)

    def run(self):
        matching_pxe_entries = {}

        for pxe_entry in self.cfg["pxe"]:
            if pxe_entry["boot_type"] == "rpi":
                self.process_rpi_entry(pxe_entry)
            elif pxe_entry["boot_type"] == "ipxe":
                matching_pxe_entries.setdefault(pxe_entry["ipxe_boot_config"], []).append(pxe_entry)
            else:
                raise ValueError(f"Unknown PXE boot_type: {pxe_entry['boot_type']}")
    
        for boot_config_name, entries in matching_pxe_entries.items():
            self.process_ipxe_config(self.cfg["ipxe"]["boot_config"][boot_config_name], entries)




if __name__ == "__main__":
    dispatcher = PXEDispatcher("../settings/pxe.yaml", "../packer/output", "./output")
    dispatcher.run()

| / 
|   /k3s
|     /k3s/vmlinuz
|     /k3s/initrd.img
|     /k3s/ipxe.efi
|   /bootcode.bin
|   /aabbccdd (<-- this is the RPi serial number)
|     /aabbccdd/config.txt
|     /aabbccdd/cmdline.txt
|     /aabbccdd/bootcode.bin
|     /aabbccdd/kernel8.img
|     /aabbccdd/initramfs8
|     /aabbccdd/<and a bunch of .dtb,.dat,.elf files ...>

- hosts: pxe_servers
  name: "Upload PXE files to TFTP and iSCSI servers"
  become: true
  gather_facts: true
  vars:
    tftp_host: router_name
    iscsi_host: storage_server_name
    pxe_local_dir: "../../../pxe/output/"
    base_iscsi_path: "{{ pxe_iscsi_path }}"
    base_tftp_path: "/usr/local/tftp/"
  tasks:
    - name: Install rsync (apt)
      apt:
        name: rsync
        state: present
      when: inventory_hostname == iscsi_host
      
    - name: Install rsync (pkg)
      community.general.pkgng:
        name: rsync
        state: present
      when: inventory_hostname == tftp_host

    - name: Upload boot files to TFTP server
      ansible.posix.synchronize:
        src: "{{ pxe_local_dir + 'tftp/' }}"
        dest: "{{ base_tftp_path }}"
        archive: true
        recursive: true
        delay_updates: false
        delete: true
        partial: true
        rsync_opts:
          - "--sparse"
          - "--inplace"
      when: inventory_hostname == tftp_host

    - name: Upload disk image to iSCSI server
      ansible.posix.synchronize:
        src: "{{ pxe_local_dir + 'iscsi/' }}"
        dest: "{{ base_iscsi_path }}"
        archive: true
        recursive: true
        delay_updates: false
        delete: true
        partial: true
        rsync_opts:
          - "--sparse"
          - "--inplace"
      when: inventory_hostname == iscsi_host